Connect Your Project Board to Anything With Webhooks

Two Directions, Often Confused

Most project tools have "webhooks" somewhere in their settings, and it's rarely clear which way they point.

Inbound webhooks let other systems call your board. GitHub and GitLab integrations work this way: a push happens, GitHub calls FlowBoard, a task gets updated.

Outbound webhooks are the reverse - your board calls other systems. When something happens in FlowBoard, it sends an HTTP POST to a URL you own, and whatever is listening decides what to do about it.

Outbound is the one that turns your project board into something the rest of your stack can react to, and it's what this article is about.

The Events

• task.created
• task.status_changed
• task.deleted
• release.published
• idea.created
• comment.created

Each webhook subscribes only to the events you choose. That's worth using properly: a webhook subscribed to everything and filtered downstream burns deliveries and makes your logs unreadable when you're trying to debug. Send status changes to one endpoint and new ideas to another.

What Teams Actually Build

Release announcements. release.published into a company-wide Slack channel, a status page, or a customer email. The release notes are already generated; the webhook just moves them.

Client-facing updates. task.status_changed filtered to a client's tag, writing into a spreadsheet or CRM. Pairs well with partner links - the link gives clients a live view, the webhook pushes updates into whatever system your account managers live in.

Deploy and docs triggers. A published release kicking off a docs build or a deployment pipeline.

Feedback routing. idea.created forwarded into a customer-feedback tool, so product research and the engineering backlog stay in sync without anyone copying text between tabs.

Blocked-task alerts. task.status_changed filtered to blocked, paging whoever is on call. A task sitting blocked overnight because nobody noticed is the most expensive kind of idle.

Verify the Signature. Really.

This is the part tutorials skip, and it matters more than any of the above.

A webhook URL is effectively public. It's sitting in a Zapier configuration, in your automation platform's logs, possibly in a screenshot in a support ticket. Anyone who learns it can POST to it, and if your handler trusts whatever arrives, you've built an unauthenticated write endpoint into your own systems.

Every FlowBoard delivery carries an X-FlowBoard-Signature header - an HMAC of the request body computed with a secret only you and FlowBoard know. Your endpoint recomputes that HMAC and rejects anything that doesn't match.

The secret is shown once when you create the webhook and is never readable from the browser afterwards. Store it when you create it; if you lose it, replace the webhook.

There's a matching protection on the outbound side: only public HTTPS endpoints are accepted. URLs pointing at internal or private network addresses are rejected, because a webhook that can be aimed at a service inside your own network is an attack vector rather than a feature.

Writing a Handler That Doesn't Break

Return quickly. Deliveries time out after ten seconds. Acknowledge the request first, queue the real work, and do it asynchronously. A handler that synchronously calls three other APIs before responding will start timing out the first time one of them is slow.

Be idempotent. Assume the same event can arrive twice and make sure handling it twice doesn't create two rows, send two emails, or trigger two deploys.

Fail loudly on your side, quietly on theirs. Every delivery attempt is logged with the response status, so you can see exactly what was sent and how your endpoint answered. Use it - a webhook silently returning 500 for a week is the classic way an automation stops working without anyone noticing.

Start with ping. There's a test event so you can confirm the plumbing and your signature verification before waiting on real activity.

Webhooks or the API?

They solve different problems and it's worth being clear which you need.

Webhooks are for reacting. Something happened; you want to do something about it. Push-based, near-immediate, no polling.

The API is for asking. You want to know the current state, or you want to change something. That includes the newer capabilities - editing tasks, bulk updates, listing members, and letting an AI agent triage the backlog.

Most real integrations use both: a webhook fires, and the handler calls the API to get the detail it needs or to write something back.

Availability

Outbound webhooks are a Starter and Pro feature. On the Free plan the settings page is visible but creating a webhook is blocked. API keys and CSV export, by contrast, are available on every plan including Free.

Summary

A project board that can't tell the rest of your stack what happened forces humans to be the integration layer - copying release notes into Slack, updating a spreadsheet after every status change. Six events, a signature you verify, and a handler that returns quickly is usually all it takes to delete that work permanently.

Get started with FlowBoard.

Frequently Asked Questions

Does FlowBoard work with Zapier and Make?

Yes. Outbound webhooks post to any HTTPS endpoint, which includes Zapier catch hooks, Make webhook triggers, n8n, and your own services.

How do I know a webhook request really came from FlowBoard?

Every delivery includes an X-FlowBoard-Signature header containing an HMAC of the request body, computed with the secret shown when you created the webhook. Recompute it and reject anything that doesn't match.

What events can trigger a webhook?

Task created, task status changed, task deleted, release published, idea created, and comment created. Each webhook subscribes only to the events you select.

What happens if my endpoint is down?

The delivery attempt is logged with its response status so you can see the failure. Deliveries time out after ten seconds, so acknowledge fast and process asynchronously.

Are webhooks available on the free plan?

No - creating outbound webhooks requires Starter or Pro. API key generation and CSV export are available on all plans.